Use an explicit lifecycle revision
This is an original revision policy, not a guarantee supplied by SCIM. The authoritative lifecycle source assigns increasing revisions. Ordinary profile updates cannot clear a deactivation, and a new hire cannot inherit an old identity just because contact fields match.
| Stored | Incoming | Decision |
|---|---|---|
| Rev 8, inactive | Rev 7, active | Ignore stale state; log comparison |
| Rev 8, inactive | Profile email change, no lifecycle decision | Update permitted profile fields only |
| Rev 8, inactive | Rev 9, authorised reactivation | Apply and verify target-specific access |
Carry the guard into a rebuild
Do not delete lifecycle tombstones as a quick fix for replay errors. When rebuilding a target, include the latest authoritative state and disposition of deleted identities. If revision data is missing, hold the change for review rather than assuming active.
A nightly profile export has active=true but no lifecycle revision. May it override rev 8 inactive?
Show the worked answer
Not under this policy. Preserve inactive, obtain the authoritative lifecycle decision and log the unsupported incoming state for investigation.